Staff Security Engineer, Detection Engineering

CoreWeave is The Essential Cloud for AI™. Built for pioneers by pioneers, CoreWeave delivers a platform of technology, tools, and teams that enables innovators to build and scale AI with confidence. Trusted by leading AI labs, startups, and global enterprises, CoreWeave combines superior infrastructure performance with deep technical expertise to accelerate breakthroughs and turn compute into capability. Founded in 2017, CoreWeave became a publicly traded company (Nasdaq: CRWV) in March 2025. Learn more at www.coreweave.com . What You’ll Do As a Staff Detection & Response Engineer & Team Lead at CoreWeave, you will drive the strategic vision, technical architecture, and execution of our threat detection and response capabilities across cutting-edge AI infrastructure. You will operate as both a high-impact individual contributor and a technical leader, guiding a team of engineers to build scalable, automated, and resilient detection systems. As a team lead and staff-level engineer, you will: Lead, mentor, and empower a team of detection engineers, fostering technical excellence, continuous growth, and an inclusive engineering culture. Architect and steer long-term detection strategies at massive scale, establishing technical standards and operational best practices across the organization. Drive cross-functional technical strategy, aligning detection engineering initiatives with broader security, infrastructure, and enterprise AI goals. Core Responsibilities: Detection-as-Code & Architecture: Design and build resilient, automated Detection-as-Code pipelines, maintaining high-fidelity detection logic, CI/CD testing frameworks, and continuous coverage validation. Data Ingestion & Security Data Lakes: Partner with Security and Data Science to deliver scalable log ingestion pipelines and security data lake infrastructure to aggregate, parse, and analyze multi-cloud and Kubernetes telemetry at petabyte scale. AI & LLM Integration: Innovate and integrate AI/LLM-driven analytics and automated triage workflows to enhance threat intelligence, anomaly detection, and incident response speed. Systemic Risk Remediation: Partner with infrastructure and product teams to identify root-cause vulnerabilities, automate incident response playbooks, and systematically eliminate recurring security risks. Technical Leadership & Influence: Provide mentorship and technical leadership across teams, setting a high bar for engineering standards, driving post-incident reviews, and representing detection strategy to leadership. Investing in our people is one of our top priorities, and we value candidates who can bring their diversified experiences to our teams. Here are some qualities we’ve found compatible with our team. We'd love to talk about whether this aligns with your experience and interests and what you’re excited to work on next. Who You Are Minimum Qualifications Proven experience in a Staff-level or Technical Lead capacity, guiding engineering teams and defining multi-year detection strategies. Demonstrated track record of implementing Detection-as-Code paradigms, automated CI/CD security pipelines, and detection engineering frameworks. Extensive experience designing, and utilizing security data lakes and distributed log ingestion pipelines for high-throughput cloud environments. Deep domain expertise in Linux internals, Kubernetes runtime security (eBPF, Falco), and cloud-native container security. Proficiency in software development and query languages (Python, Go, SQL, KQL, etc.) to build tooling and automated remediation engines. Strong leadership skills with a passion for mentoring junior/mid-level engineers and establishing strong engineering practices. Preferred Qualifications Experience applying AI, machine learning, or LLMs to detection engineering, threat intelligence synthesis, or automated incident triage. Active open-source security contributions or public technical research in threat detection, Kubernetes security, or cloud defense. Prior leadership or team lead experience in high-growth cloud or AI hyperscaler environments. Please note that this role is not a typical 9-5 job. There may be instances where real-time incident response requires active participation outside business hours. On-call hours (including weekends and holidays) and all-hands-on-deck participation during active incidents are expected. If crafting sophisticated detection strategies and staying ahead of threats in a dynamic, innovative environment excites you, we’d love to connect! The base salary range for this role is $207,000 to $275,000. The starting salary will be determined based on job-related knowledge, skills, experience, and market location. We strive for both market alignment and internal equity when determining compensation. In addition to base salary, our total rewards package includes a discretionary bonus, equity awards, and a comprehensive benefits program (all based on eligibility). What We Offer The range we’ve posted represents the typical compensation range for this role. To determine actual compensation, we review the market rate for each candidate which can include a variety of factors. These include qualifications, experience, interview performance, and location. In addition to a competitive salary, we offer a variety of benefits to support your needs. The benefits below reflect our US-based offerings for full-time employees; for roles in other locations, benefits vary and are shared during the hiring process. These include: Medical, dental, and vision insurance - 100% paid for by CoreWeave Company-paid Life Insurance Voluntary supplemental life insurance Short and long-term disability insurance Flexible Spending Account Health Savings Account Tuition Reimbursement Ability to Participate in Employee Stock Purchase Program (ESPP) Mental Wellness Benefits through Spring Health Family-Forming support provided by Carrot Paid Parental Leave Flexible, full-service childcare support with Kinside 401(k) with a generous employer match Flexible PTO Catered lunch each day in our office and data center locations A casual work environment A work culture focused on innovative disruption California Applicants California Consumer Privacy Act Equal Opportunity & Accommodations CoreWeave is an equal opportunity employer, committed to fostering an inclusive and supportive workplace. All qualified applicants and candidates will receive consideration for employment without regard to race, color, religion, sex, disability, age, sexual orientation, gender identity, national origin, veteran status, or genetic information. As part of this commitment and consistent with the Americans with Disabilities Act (ADA) , CoreWeave will ensure that qualified applicants and candidates with disabilities are provided reasonable accommodations for the hiring process, unless such accommodation would cause an undue hardship. If reasonable accommodation is needed, please contact: careers@coreweave.com . Export Control Compliance This position requires access to export controlled information. To conform to U.S. Government export regulations applicable to that information, applicant must either be (A) a U.S. person, defined as a (i) U.S. citizen or national, (ii) U.S. lawful permanent resident (green card holder), (iii) refugee under 8 U.S.C. § 1157, or (iv) asylee under 8 U.S.C. § 1158, (B) eligible to access the export controlled information without a required export authorization, or (C) eligible and reasonably likely to obtain the required export authorization from the applicable U.S. government agency. CoreWeave may, for legitimate business reasons, decline to pursue any export licensing process.